Observe public DNS, TLS and baseline response headers through HTTPS HEAD / on port443; no full-path scan or global trust assessment.